Deployment Architecture

Steps to add additional storage to Indexers in cluster


Hi Splunkers ,

Our splunk indexers disk has reached 90% and decided to extend the capacity. We have 3 indexers in cluster . What are the steps to be followed to increase the capacity.  Indexers are linux based and the replication factor is 3. 


1. Can we increase the storage on the fly without any downtime

2. Will it affect the existing buckets? Any backup is required.


Thanks in Advance 

Labels (1)
Tags (1)


Hi @spl_unker,

If you are using LVM , it is possible increasing partition on the fly. Please check with your system admin. This will not effect the buckets. Otherwise you may need reboot the system or create a new partition and copy the buckets to new partition.

In any case, it is better enable maintenance mode first, doing resize operation on one indexer at a time and disabling maintenance mode after each indexer to allow cluster master make necessary fix ups.  This will also prevent data loss in case of a failure on one indexer.

If this reply helps you an upvote is appreciated.
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...